Back to skill

Security audit

Multi Search Engine 2.1.3

Security checks for vulnerabilities and agentic risk

Overview

This search skill is not malware, but its privacy notice falsely says no external data is transmitted even though searches are sent to many third-party engines.

Review before installing. Use this only if you are comfortable sending search terms and request metadata to the selected search engines, including China-region and global providers. Avoid secrets, credentials, personal data, or confidential business queries, and manually constrain engines/regions where possible.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
ription: "Multi search engine integration with 16 engines (7 CN + 9 Global). Supports advanced search operators, time filters, site search, privacy engines, and WolframAlpha knowledge queries. No API keys required."
---

# Multi Search Engine

Integration of 16 search engines for web crawling without API keys.

## Workflow

1. **Preparation**: AI Agent initializes an empty in-memory cookie store. Cookies are only acquired dynamically during search operations when access is denied

2. **Language Evaluation**: Detect the language attribute of the search query. If the query is in Chinese, use Domestic search engines (Baidu, Bing CN, Bing INT, 360, Sogou, WeChat, Shenma). If the query is non-Chinese, use International search engines (Google, Google HK, DuckDuckGo, Yahoo, Startpage, Brave, Ecosia, Qwant, WolframAlpha). Select engines based on query relevance and availability.

3. **Controlled Search**: Use web_fetch to execute search requests with rate limiting:
   - Add 1-2 second delay be

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly performs outbound requests to third-party search engines, so the claim that operations involve 'no external data transmission' is materially false. This can mislead users and operators about where queries and request metadata are sent, undermining informed consent and privacy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Stating 'no external data transmission' while the workflow sends queries and request metadata to outside services is a direct privacy-policy contradiction. This is especially concerning in a search aggregation skill because the entire function depends on third-party network transmission, so the misstatement could systematically mislead every user.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Most of the skill's descriptive content and labels are presented only in Chinese, which can amount to a language policy issue if users are not given a language or locale option. The file does not indicate that the skill is region-specific or that Chinese is an intentional, documented constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description advertises multi-engine search and no API keys but does not clearly warn that user queries are transmitted to third-party search engines. Missing this disclosure can cause users to submit sensitive data under false assumptions about locality or confidentiality.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Automatically routing Chinese-language queries to a predefined set of domestic engines changes the data recipient based on content without explicit user approval. In this context, that increases privacy and policy risk because queries may be sent to providers with different legal regimes, censorship behavior, or tracking practices than the user expects.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

User-provided search queries are sent to external search providers and may contain personal, confidential, or regulated information. Claiming that no personal information is transmitted is inaccurate because users often include identifiers or sensitive content in queries, and transmission to third parties creates privacy and compliance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This manifest-like JSON defines multiple engines with explicit "cn" region settings, including a China-specific Bing endpoint, but provides no indication that users can choose a different locale or opt in to region-restricted behavior. The policy for natural-language violations applies to config values as well, and these locale constraints appear forced rather than user-selectable or justified in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file contains natural-language guidance exclusively in Chinese, including headings, descriptions, and usage examples. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation unless the regional constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest frames the skill as a multi-search-engine integration for search operators, filters, privacy engines, and knowledge queries. These documented capabilities are generic utility transformations and content generation features rather than search functionality, so they are not clearly justified by the stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The guide explicitly documents a parameter to disable SafeSearch (kp=-1) without any warning, age-safety context, or policy guardrails. In a broadly reusable search skill, this increases the likelihood of retrieving explicit, harmful, or otherwise unsafe content, especially if downstream agents or users treat the examples as endorsed defaults.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The stated purpose is multi-engine search integration, but these lines describe an anonymizing proxy-browsing capability ('代理浏览', '匿名访问搜索结果') that is materially different from submitting search queries. Proxy access changes the capability from search to indirect browsing, which is not clearly justified by the manifest's declared scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown file includes concrete web_fetch examples that send search queries to external services such as Google and DuckDuckGo. The document does not warn that user queries may be transmitted to third-party search providers, which is relevant to privacy and data handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

SQP-3 covers natural-language policy issues including forcing a specific language without user opt-in. This guide is wholly Chinese-language and provides no alternative language option or statement that the content is intentionally region/language-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
73% confidence
Finding

The guide explicitly labels the cache example as '查看已删除内容' but provides no caution that cached pages may contain outdated, removed, or sensitive material. In a markdown skill guide, this is a user-facing behavior that merits disclosure before use.

Content

No source excerpt is available for this finding.